Clarify that enrollment URLs are sensitive bearer material and must not be transported in redirect query strings or logs.